A ready-made kit for fraud is being sold for $500 on a cybercriminal forum. Anyone with almost no technical skills can set up a fake $TSLA token pre-sale and drain the wallets of anyone who invests.
Hacker Sells Scam as a Ready-Made Product
This tool kit was developed by a forum user with the handle xrep, who has been active in the cybercriminal underground since March 2026. It has received positive feedback from other criminals.
Researchers stated that this product is a "complete scam in a box." The kit includes hosting, phishing pages, a fake investment dashboard, and tools for trac victims.
Cybersecurity specialists from Malwarebytes discovered the fraudulent scheme on May 16. It displays a pre-sale page with the Tesla name and logo, presented as an exclusive early purchase opportunity for X users. The website operates in multiple languages and works on both phones and computers.
At the start of the attack, an X user is asked to pass an "eligibility check." The page then displays that user's real profile picture to create the impression that the offer was selected for them.
The scam creates a sense of FOMO (fear of missing out) using a progress bar that starts filling, a countdown timer, and warnings about an imminent price increase.
The first investment option offers a 15% bonus for connecting a wallet. Then the form requests the 12-word recovery phrase to completely drain the cryptocurrency wallets.
Another "investment" option bypasses the wallet and asks the victim to send Bitcoin, Ethereum, USDT, or Dogecoin to an address controlled by the operator. In the end, the buyer sees a fake balance on their account.
Fraud Kit Steals Location and Recovery Phrases
The dashboard makes the kit more dangerous. It allows the operator to see how victims navigate the site, log usernames and locations, and collect recovery phrases entered on the phishing page. The operator can check if a wallet contains anything valuable to steal before attempting to take it over.
It can also artificially inflate the balance on request, making the user believe their investment is paying off and pay even more. If the user has already paid, the dashboard sends a message demanding an additional network fee.
On August 3rd, the U.S. Internal Revenue Service warned that scammers are sending letters to cryptocurrency owners, directing them to a fake "Digital Asset Compliance Portal" that looks like IRS[.]gov, aiming to steal wallet login creddentials. According to the agency, such a portal does not exist.
In May, Cryptopolitan reported that scammers were sending printed letters to Ledger owners. These letters described a fake "Quantum Resistance Security Update" that used QR codes to phish for 24-word recovery phrases.
end-content
